@nextsparkjs/core 0.1.0-beta.194 → 0.1.0-beta.196

package/dist/components/entities/wrappers/EntityListWrapper.js

@@ -12,6 +12,7 @@ import { SkeletonEntityList } from "../../ui/skeleton-list.js";
 import { SearchInput } from "../../shared/SearchInput.js";
 import { MultiSelectFilter } from "../../shared/MultiSelectFilter.js";
 import { useEntityConfig } from "../../../hooks/useEntityConfig.js";
+import { useAuth } from "../../../hooks/useAuth.js";
 import { useUrlFilters } from "../../../hooks/useUrlFilters.js";
 import { listEntityData, deleteEntityData, duplicateEntityData } from "../../../lib/api/entities.js";
 import { useTeam } from "../../../hooks/useTeam.js";
@@ -24,6 +25,8 @@ function EntityListWrapper({
   headerActions
 }) {
   var _a, _b;
+  const { user } = useAuth();
+  const signedIn = Boolean(user);
   const router = useRouter();
   const { config: entityConfig, isLoading, error: configError, isOverride } = useEntityConfig(entityType);
   const { teamId } = useTeam();
@@ -122,7 +125,7 @@ function EntityListWrapper({
     return true;
   }, [filters, entityConfig == null ? void 0 : entityConfig.ui.dashboard.filters, schemaKeysForSync]);
   useEffect(() => {
-    if (!(entityConfig == null ? void 0 : entityConfig.slug)) return;
+    if (!(entityConfig == null ? void 0 : entityConfig.slug) || !signedIn) return;
     if (!filtersMatchUrl) return;
     const isInitial = !hasLoadedRef.current;
     const filtersChanged = prevFiltersKeyRef.current !== filtersKey;
@@ -131,7 +134,7 @@ function EntityListWrapper({
       hasLoadedRef.current = true;
       loadData(isInitial);
     }
-  }, [entityConfig == null ? void 0 : entityConfig.slug, filtersKey, filtersMatchUrl, loadData]);
+  }, [entityConfig == null ? void 0 : entityConfig.slug, filtersKey, filtersMatchUrl, loadData, signedIn]);
   const handleSearch = useCallback((query) => {
     setFilter("search", query);
   }, [setFilter]);

package/dist/components/settings/layouts/SettingsSidebar.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SettingsSidebar.d.ts","sourceRoot":"","sources":["../../../../src/components/settings/layouts/SettingsSidebar.tsx"],"names":[],"mappings":"AAoCA,UAAU,oBAAoB;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,eAAe,CAAC,EAAE,SAAS,EAAE,EAAE,oBAAoB,2CAkKlE"}
+{"version":3,"file":"SettingsSidebar.d.ts","sourceRoot":"","sources":["../../../../src/components/settings/layouts/SettingsSidebar.tsx"],"names":[],"mappings":"AAoCA,UAAU,oBAAoB;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,eAAe,CAAC,EAAE,SAAS,EAAE,EAAE,oBAAoB,2CAiKlE"}

package/dist/components/settings/layouts/SettingsSidebar.js

@@ -50,7 +50,6 @@ function SettingsSidebar({ className }) {
   }, [prefetchProfile, prefetchTeams]);
   const filteredNavigation = useMemo(() => {
     const enabledPages = getEnabledSettingsPages();
-    if (process.env.NODE_ENV === "development") console.log("[SettingsSidebar] enabledPages:", enabledPages);
     return enabledPages.filter((page) => {
       if (page.key === "password" && !hasPassword) {
         return false;

package/dist/components/teams/CreateTeamButton.js

@@ -30,10 +30,10 @@ function CreateTeamButton({
       className,
       onClick,
       "data-cy": "create-team-button",
-      "aria-label": t("create.createTeam"),
+      "aria-label": t("actions.create"),
       children: [
         showIcon && /* @__PURE__ */ jsx(Plus, { className: "h-4 w-4 mr-2", "aria-hidden": "true" }),
-        children || t("create.createTeam")
+        children || t("actions.create")
       ]
     }
   );

package/dist/components/teams/CreateTeamDialog.js

@@ -39,7 +39,7 @@ function CreateTeamDialog({ open, onOpenChange }) {
       setSlug("");
       setDescription("");
     } catch (error) {
-      toast.error(error instanceof Error ? error.message : t("errors.unauthorized"));
+      toast.error(error instanceof Error ? error.message : t("errors.permissionDenied"));
     }
   };
   const handleNameChange = (value) => {

package/dist/components/teams/InviteMemberButton.js

@@ -39,7 +39,7 @@ function InviteMemberButton({
           "aria-label": t("invite.limitReached", { limit: maxMembersPerTeam }),
           children: [
             showIcon && /* @__PURE__ */ jsx(UserPlus, { className: "h-4 w-4 mr-2", "aria-hidden": "true" }),
-            children || t("invite.inviteMember")
+            children || t("actions.invite")
           ]
         }
       ) }),
@@ -54,10 +54,10 @@ function InviteMemberButton({
       className,
       onClick,
       "data-cy": "invite-member-button",
-      "aria-label": t("invite.inviteMember"),
+      "aria-label": t("actions.invite"),
       children: [
         showIcon && /* @__PURE__ */ jsx(UserPlus, { className: "h-4 w-4 mr-2", "aria-hidden": "true" }),
-        children || t("invite.inviteMember")
+        children || t("actions.invite")
       ]
     }
   );

package/dist/components/teams/InviteMemberDialog.js

@@ -49,7 +49,7 @@ function InviteMemberDialog({ open, onOpenChange, teamId, currentUserRole = "own
       setEmail("");
       setRole(defaultRole);
     } catch (error) {
-      toast.error(error instanceof Error ? error.message : t("errors.unauthorized"));
+      toast.error(error instanceof Error ? error.message : t("errors.permissionDenied"));
     }
   };
   return /* @__PURE__ */ jsx(Dialog, { open, onOpenChange, children: /* @__PURE__ */ jsx(DialogContent, { "data-cy": "invite-member-dialog", children: /* @__PURE__ */ jsxs("form", { onSubmit: handleSubmit, children: [

package/dist/components/teams/TeamPendingInvitations.js

@@ -73,11 +73,11 @@ function TeamPendingInvitations({ teamId }) {
     },
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: ["team-invitations", teamId] });
-      toast.success(t("messages.invitationCancelled"));
+      toast.success(t("invitations.cancelSuccess"));
       setCancellingId(null);
     },
     onError: (error) => {
-      toast.error(error instanceof Error ? error.message : t("errors.unauthorized"));
+      toast.error(error instanceof Error ? error.message : t("errors.permissionDenied"));
       setCancellingId(null);
     }
   });

package/dist/components/ui/relation-display.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relation-display.d.ts","sourceRoot":"","sources":["../../../src/components/ui/relation-display.tsx"],"names":[],"mappings":"AAMA,UAAU,oBAAoB;IAC5B,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpC,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAGD,wBAAgB,eAAe,CAAC,EAC9B,KAAK,EACL,UAAU,EACV,UAAU,EACV,QAAQ,EACR,QAAgB,EAChB,MAAM,EACP,EAAE,oBAAoB,2CAgJtB"}
+{"version":3,"file":"relation-display.d.ts","sourceRoot":"","sources":["../../../src/components/ui/relation-display.tsx"],"names":[],"mappings":"AAOA,UAAU,oBAAoB;IAC5B,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpC,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAGD,wBAAgB,eAAe,CAAC,EAC9B,KAAK,EACL,UAAU,EACV,UAAU,EACV,QAAQ,EACR,QAAgB,EAChB,MAAM,EACP,EAAE,oBAAoB,2CAgJtB"}

package/dist/components/ui/relation-display.js

@@ -3,6 +3,7 @@ import { jsx } from "react/jsx-runtime";
 import * as React from "react";
 import { parseClientChildEntity as parseChildEntity, getClientEntityApiPath as getEntityApiPath } from "../../lib/entities/client-entity-meta.js";
 import { withBasePath } from "../../lib/base-path.js";
+import { TEAM_ID_HEADER } from "../../lib/api/client-headers.js";
 function RelationDisplay({
   value,
   entityType,
@@ -76,7 +77,7 @@ function RelationDisplay({
           method: "GET",
           headers: {
             "Content-Type": "application/json",
-            ...teamId && { "x-team-id": teamId }
+            ...teamId && { [TEAM_ID_HEADER]: teamId }
           },
           credentials: "include"
         });

package/dist/components/ui/user-display.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-display.d.ts","sourceRoot":"","sources":["../../../src/components/ui/user-display.tsx"],"names":[],"mappings":"AASA,UAAU,gBAAgB;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAChC,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAUD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,EAC1B,KAAK,EACL,MAAM,EAAE,UAAU,EAClB,QAAgB,EAChB,SAAiB,EACjB,SAAS,GACV,EAAE,gBAAgB,2CA0IlB"}
+{"version":3,"file":"user-display.d.ts","sourceRoot":"","sources":["../../../src/components/ui/user-display.tsx"],"names":[],"mappings":"AAUA,UAAU,gBAAgB;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAChC,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAUD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,EAC1B,KAAK,EACL,MAAM,EAAE,UAAU,EAClB,QAAgB,EAChB,SAAiB,EACjB,SAAS,GACV,EAAE,gBAAgB,2CA0IlB"}

package/dist/components/ui/user-display.js

@@ -6,6 +6,7 @@ import { Badge } from "./badge.js";
 import { cn } from "../../lib/utils/index.js";
 import { useTeam } from "../../hooks/useTeam.js";
 import { withBasePath } from "../../lib/base-path.js";
+import { TEAM_ID_HEADER } from "../../lib/api/client-headers.js";
 function UserDisplay({
   value,
   teamId: propTeamId,
@@ -37,7 +38,7 @@ function UserDisplay({
         const response = await fetch(withBasePath(`/api/v1/teams/${effectiveTeamId}/members`), {
           headers: {
             "Content-Type": "application/json",
-            "x-team-id": effectiveTeamId
+            [TEAM_ID_HEADER]: effectiveTeamId
           },
           credentials: "include"
         });

package/dist/emails/otp-verification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"otp-verification.d.ts","sourceRoot":"","sources":["../../src/emails/otp-verification.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAKjF,wBAA8B,eAAe,CAC3C,IAAI,EAAE,wBAAwB,EAC9B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CAuEvB"}
+{"version":3,"file":"otp-verification.d.ts","sourceRoot":"","sources":["../../src/emails/otp-verification.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAKjF,wBAA8B,eAAe,CAC3C,IAAI,EAAE,wBAAwB,EAC9B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CAyEvB"}

package/dist/emails/otp-verification.js

@@ -1,9 +1,11 @@
 import { getTranslations } from "next-intl/server";
+import { escapeHtml } from "../lib/auth/security-notifications/templates/shared.js";
 import { DEFAULT_OTP_CONFIG } from "../lib/auth/otp-config.js";
 const APP_NAME_FALLBACK = process.env.NEXT_PUBLIC_APP_NAME || "Your App";
 async function otpVerification(data, locale) {
   const t = locale ? await getTranslations({ locale, namespace: "email.otpVerification" }) : await getTranslations("email.otpVerification");
   const appName = data.appName || APP_NAME_FALLBACK;
+  const htmlAppName = escapeHtml(appName);
   const year = (/* @__PURE__ */ new Date()).getFullYear();
   const expiresInMinutes = Math.floor((data.expiresIn ?? DEFAULT_OTP_CONFIG.expiresIn) / 60);
   return {
@@ -23,7 +25,7 @@ async function otpVerification(data, locale) {
                   <!-- Header -->
                   <tr>
                     <td style="padding: 40px 40px 20px 40px; text-align: center; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); border-radius: 8px 8px 0 0;">
-                      <h1 style="color: #ffffff; font-size: 28px; margin: 0; font-weight: 600;">${appName}</h1>
+                      <h1 style="color: #ffffff; font-size: 28px; margin: 0; font-weight: 600;">${htmlAppName}</h1>
                       <p style="color: #ffffff; font-size: 16px; margin: 10px 0 0 0; opacity: 0.95;">${t("headerSubtitle")}</p>
                     </td>
                   </tr>
@@ -52,10 +54,10 @@ async function otpVerification(data, locale) {
                   <tr>
                     <td style="padding: 30px 40px; background-color: #f8f8f8; border-radius: 0 0 8px 8px; text-align: center;">
                       <p style="color: #999999; font-size: 14px; margin: 0 0 10px 0;">
-                        ${t("copyright", { year, appName })}
+                        ${t("copyright", { year, appName: htmlAppName })}
                       </p>
                       <p style="color: #999999; font-size: 12px; margin: 0;">
-                        ${t("footerLine1", { appName })}
+                        ${t("footerLine1", { appName: htmlAppName })}
                       </p>
                     </td>
                   </tr>

package/dist/emails/reset-password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reset-password.d.ts","sourceRoot":"","sources":["../../src/emails/reset-password.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAI/E,wBAA8B,aAAa,CACzC,IAAI,EAAE,sBAAsB,EAC5B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CA4FvB"}
+{"version":3,"file":"reset-password.d.ts","sourceRoot":"","sources":["../../src/emails/reset-password.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAI/E,wBAA8B,aAAa,CACzC,IAAI,EAAE,sBAAsB,EAC5B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CA8FvB"}

package/dist/emails/reset-password.js

@@ -1,8 +1,10 @@
 import { getTranslations } from "next-intl/server";
+import { escapeHtml } from "../lib/auth/security-notifications/templates/shared.js";
 const APP_NAME_FALLBACK = process.env.NEXT_PUBLIC_APP_NAME || "Your App";
 async function resetPassword(data, locale) {
   const t = locale ? await getTranslations({ locale, namespace: "email.resetPassword" }) : await getTranslations("email.resetPassword");
   const appName = data.appName || APP_NAME_FALLBACK;
+  const htmlAppName = escapeHtml(appName);
   const year = (/* @__PURE__ */ new Date()).getFullYear();
   const greeting = `${t("greetingPrefix")}${data.userName ? ` ${data.userName}` : ""},`;
   const expiresIn = data.expiresIn || t("defaultExpiresIn");
@@ -23,7 +25,7 @@ async function resetPassword(data, locale) {
                   <!-- Header -->
                   <tr>
                     <td style="padding: 40px 40px 20px 40px; text-align: center; background: linear-gradient(135deg, #f093fb 0%, #f5576c 100%); border-radius: 8px 8px 0 0;">
-                      <h1 style="color: #ffffff; font-size: 28px; margin: 0; font-weight: 600;">${appName}</h1>
+                      <h1 style="color: #ffffff; font-size: 28px; margin: 0; font-weight: 600;">${htmlAppName}</h1>
                       <p style="color: #ffffff; font-size: 16px; margin: 10px 0 0 0; opacity: 0.95;">${t("headerSubtitle")}</p>
                     </td>
                   </tr>
@@ -73,10 +75,10 @@ async function resetPassword(data, locale) {
                   <tr>
                     <td style="padding: 30px 40px; background-color: #f8f8f8; border-radius: 0 0 8px 8px; text-align: center;">
                       <p style="color: #999999; font-size: 14px; margin: 0 0 10px 0;">
-                        ${t("copyright", { year, appName })}
+                        ${t("copyright", { year, appName: htmlAppName })}
                       </p>
                       <p style="color: #999999; font-size: 12px; margin: 0;">
-                        ${t("footerLine1", { appName })}
+                        ${t("footerLine1", { appName: htmlAppName })}
                         <br>${t("footerLine2")}
                       </p>
                     </td>

package/dist/emails/team-invitation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"team-invitation.d.ts","sourceRoot":"","sources":["../../src/emails/team-invitation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAKhF,wBAA8B,cAAc,CAC1C,IAAI,EAAE,uBAAuB,EAC7B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CA0FvB"}
+{"version":3,"file":"team-invitation.d.ts","sourceRoot":"","sources":["../../src/emails/team-invitation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAKhF,wBAA8B,cAAc,CAC1C,IAAI,EAAE,uBAAuB,EAC7B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CA4FvB"}

package/dist/emails/team-invitation.js

@@ -4,6 +4,7 @@ const APP_NAME_FALLBACK = process.env.NEXT_PUBLIC_APP_NAME || "Your App";
 async function teamInvitation(data, locale) {
   const t = locale ? await getTranslations({ locale, namespace: "email.teamInvitation" }) : await getTranslations("email.teamInvitation");
   const appName = data.appName || APP_NAME_FALLBACK;
+  const htmlAppName = escapeHtml(appName);
   const year = (/* @__PURE__ */ new Date()).getFullYear();
   return {
     subject: t("subject", { teamName: data.teamName, appName }),
@@ -22,7 +23,7 @@ async function teamInvitation(data, locale) {
                   <!-- Header -->
                   <tr>
                     <td style="padding: 40px 40px 20px 40px; text-align: center; background: linear-gradient(135deg, #4F46E5 0%, #7C3AED 100%); border-radius: 8px 8px 0 0;">
-                      <h1 style="color: #ffffff; font-size: 28px; margin: 0; font-weight: 600;">${appName}</h1>
+                      <h1 style="color: #ffffff; font-size: 28px; margin: 0; font-weight: 600;">${htmlAppName}</h1>
                       <p style="color: #ffffff; font-size: 16px; margin: 10px 0 0 0; opacity: 0.95;">${t("headerSubtitle")}</p>
                     </td>
                   </tr>
@@ -72,7 +73,7 @@ async function teamInvitation(data, locale) {
                   <tr>
                     <td style="padding: 30px 40px; background-color: #f8f8f8; border-radius: 0 0 8px 8px; text-align: center;">
                       <p style="color: #999999; font-size: 14px; margin: 0 0 10px 0;">
-                        ${t("copyright", { year, appName })}
+                        ${t("copyright", { year, appName: htmlAppName })}
                       </p>
                       <p style="color: #999999; font-size: 12px; margin: 0;">
                         ${t("footerSentTo", { inviteeEmail: escapeHtml(data.inviteeEmail) })}<br>

package/dist/emails/verify-email.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-email.d.ts","sourceRoot":"","sources":["../../src/emails/verify-email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAI9E,wBAA8B,WAAW,CACvC,IAAI,EAAE,qBAAqB,EAC3B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CAiFvB"}
+{"version":3,"file":"verify-email.d.ts","sourceRoot":"","sources":["../../src/emails/verify-email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAI9E,wBAA8B,WAAW,CACvC,IAAI,EAAE,qBAAqB,EAC3B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CAmFvB"}

package/dist/emails/verify-email.js

@@ -1,8 +1,10 @@
 import { getTranslations } from "next-intl/server";
+import { escapeHtml } from "../lib/auth/security-notifications/templates/shared.js";
 const APP_NAME_FALLBACK = process.env.NEXT_PUBLIC_APP_NAME || "Your App";
 async function verifyEmail(data, locale) {
   const t = locale ? await getTranslations({ locale, namespace: "email.verifyEmail" }) : await getTranslations("email.verifyEmail");
   const appName = data.appName || APP_NAME_FALLBACK;
+  const htmlAppName = escapeHtml(appName);
   const year = (/* @__PURE__ */ new Date()).getFullYear();
   const greeting = `${t("greetingPrefix")}${data.userName ? ` ${data.userName}` : ""},`;
   return {
@@ -22,7 +24,7 @@ async function verifyEmail(data, locale) {
                   <!-- Header -->
                   <tr>
                     <td style="padding: 40px 40px 20px 40px; text-align: center; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); border-radius: 8px 8px 0 0;">
-                      <h1 style="color: #ffffff; font-size: 28px; margin: 0; font-weight: 600;">${appName}</h1>
+                      <h1 style="color: #ffffff; font-size: 28px; margin: 0; font-weight: 600;">${htmlAppName}</h1>
                       <p style="color: #ffffff; font-size: 16px; margin: 10px 0 0 0; opacity: 0.95;">${t("headerSubtitle")}</p>
                     </td>
                   </tr>
@@ -62,10 +64,10 @@ async function verifyEmail(data, locale) {
                   <tr>
                     <td style="padding: 30px 40px; background-color: #f8f8f8; border-radius: 0 0 8px 8px; text-align: center;">
                       <p style="color: #999999; font-size: 14px; margin: 0 0 10px 0;">
-                        ${t("copyright", { year, appName })}
+                        ${t("copyright", { year, appName: htmlAppName })}
                       </p>
                       <p style="color: #999999; font-size: 12px; margin: 0;">
-                        ${t("footerLine1", { appName })}
+                        ${t("footerLine1", { appName: htmlAppName })}
                         <br>${t("footerLine2")}
                       </p>
                     </td>

package/dist/hooks/useAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../../src/hooks/useAuth.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AA4C9C;;;GAGG;AACH,wBAAgB,cAAc;8CAYiC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;+DAqBvC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA2E1H,MAAM;qBAlCjB,MAAM;;;gDAgBiB;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;iBAwG1G,CADD;;;;;;;;;;;;;2BA5EuC,MAAM;;;;;;;;;;;;kCA6BC,MAAM,UAAU,MAAM;;;;;;;;;;;sCAwClB,MAAM,eAAe,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA8B5B,MAAM;;;;;;;;;;;EAwC3D;AAED,8DAA8D;AAC9D,wBAAgB,OAAO;;;;;8CAvPwC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;+DAqBvC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA2E1H,MAAM;qBAlCjB,MAAM;;;gDAgBiB;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;iBAwG1G,CADD;;;;;;;;;;;;;2BA5EuC,MAAM;;;;;;;;;;;;kCA6BC,MAAM,UAAU,MAAM;;;;;;;;;;;sCAwClB,MAAM,eAAe,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA8B5B,MAAM;;;;;;;;;;;UAqD5B,WAAW,GAAG,IAAI;;;;;;;;;;;;;;;;;;;;;;;EASjD"}
+{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../../src/hooks/useAuth.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAwE9C;;;GAGG;AACH,wBAAgB,cAAc;8CAYiC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;+DAqBvC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAmF1H,MAAM;qBAlCjB,MAAM;;;gDAgBiB;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;iBAY9F,CAAC;;;;;;;;;;;;;2BAeyB,MAAM;;;;;;;;;;;;kCA6BC,MAAM,UAAU,MAAM;;;;;;;;;;;sCAwClB,MAAM,eAAe,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA8B5B,MAAM;;;;;;;;;;;EAwC3D;AAED,8DAA8D;AAC9D,wBAAgB,OAAO;;;;;8CA/PwC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;+DAqBvC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAmF1H,MAAM;qBAlCjB,MAAM;;;gDAgBiB;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;iBAY9F,CAAC;;;;;;;;;;;;;2BAeyB,MAAM;;;;;;;;;;;;kCA6BC,MAAM,UAAU,MAAM;;;;;;;;;;;sCAwClB,MAAM,eAAe,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA8B5B,MAAM;;;;;;;;;;;UAqD5B,WAAW,GAAG,IAAI;;;;;;;;;;;;;;;;;;;;;;;EASjD"}

package/dist/hooks/useAuth.js

@@ -7,9 +7,11 @@ import { useOrigin } from "./useOrigin.js";
 import { useLastAuthMethod } from "./useLastAuthMethod.js";
 import { safeCallbackPath } from "../lib/auth/callback-url.js";
 import { withBasePath } from "../lib/base-path.js";
+import { loadLoginPage } from "../lib/auth/load-login-page.js";
 import { setSessionHint } from "../lib/auth/session-hint.js";
 import { setUserLocaleClient } from "../lib/locale-client.js";
 import { I18N_CONFIG } from "../lib/config/i18n-config-client.js";
+import { SIGNUP_INTENT_HEADER } from "../lib/api/client-headers.js";
 function googleCallbackURL(redirectTo) {
   const url = new URL(safeCallbackPath(redirectTo) ?? "/dashboard", "http://callback.invalid");
   url.searchParams.set("auth_method", "google");
@@ -23,6 +25,20 @@ function rememberSignedIn(user) {
     setUserLocaleClient(language);
   }
 }
+const SESSION_DROP_TIMEOUT_MS = 2e3;
+async function waitForSessionToDrop() {
+  var _a, _b, _c, _d, _e, _f;
+  let timer;
+  try {
+    const refetch = (_f = (_e = (_d = (_c = (_b = (_a = authClient.$store) == null ? void 0 : _a.atoms) == null ? void 0 : _b.session) == null ? void 0 : _c.get) == null ? void 0 : _d.call(_c)) == null ? void 0 : _e.refetch) == null ? void 0 : _f.call(_e);
+    await Promise.race([refetch, new Promise((resolve) => {
+      timer = setTimeout(resolve, SESSION_DROP_TIMEOUT_MS);
+    })]);
+  } catch {
+  } finally {
+    clearTimeout(timer);
+  }
+}
 function useAuthActions() {
   const router = useRouter();
   const origin = useOrigin();
@@ -57,7 +73,7 @@ function useAuthActions() {
       },
       // Optional signup intent, sent as the `x-signup-intent` header. The signup
       // route maps it to an initial team role (AUTH_CONFIG.signupIntent).
-      intent ? { headers: { "x-signup-intent": intent } } : void 0
+      intent ? { headers: { [SIGNUP_INTENT_HEADER]: intent } } : void 0
     );
     if (error) {
       throw new Error(error.message || "Failed to create account");
@@ -68,10 +84,11 @@ function useAuthActions() {
     if (typeof window !== "undefined") {
       localStorage.removeItem("activeTeamId");
     }
-    await authClient.signOut();
+    const { error } = await authClient.signOut();
+    if (error) throw new Error(error.message || "Failed to sign out");
     setSessionHint(false);
-    forgetSignedInData();
-    router.push("/login");
+    await waitForSessionToDrop();
+    loadLoginPage();
   };
   const handleSendOtp = async (email) => {
     const { data, error } = await authClient.emailOtp.sendVerificationOtp({

package/dist/hooks/usePatternUsages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usePatternUsages.d.ts","sourceRoot":"","sources":["../../src/hooks/usePatternUsages.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB,MAAM,EAAE,iBAAiB,EAAE,CAAA;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,uBAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4EtC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,iEA8BxD"}
+{"version":3,"file":"usePatternUsages.d.ts","sourceRoot":"","sources":["../../src/hooks/usePatternUsages.ts"],"names":[],"mappings":"AAQA;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB,MAAM,EAAE,iBAAiB,EAAE,CAAA;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,uBAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4EtC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,iEA8BxD"}

package/dist/hooks/usePatternUsages.js

@@ -3,6 +3,7 @@ import { useQuery } from "@tanstack/react-query";
 import { useAuth } from "./useAuth.js";
 import { useTeam } from "./useTeam.js";
 import { withBasePath } from "../lib/base-path.js";
+import { TEAM_ID_HEADER } from "../lib/api/client-headers.js";
 function usePatternUsages(patternId, options = {}) {
   var _a, _b, _c, _d, _e;
   const {
@@ -37,7 +38,7 @@ function usePatternUsages(patternId, options = {}) {
         "Content-Type": "application/json"
       };
       if (teamId) {
-        headers["x-team-id"] = teamId;
+        headers[TEAM_ID_HEADER] = teamId;
       }
       const response = await fetch(withBasePath(url), { headers });
       if (!response.ok) {
@@ -81,7 +82,7 @@ function usePatternUsageCount(patternId, options = {}) {
         "Content-Type": "application/json"
       };
       if (teamId) {
-        headers["x-team-id"] = teamId;
+        headers[TEAM_ID_HEADER] = teamId;
       }
       const response = await fetch(withBasePath(`/api/v1/patterns/${patternId}/usages?limit=1`), { headers });
       if (!response.ok) {

package/dist/lib/api/api-error.d.ts

@@ -11,6 +11,8 @@ export declare const API_ERROR_CODES: {
     readonly INSUFFICIENT_SCOPE: "INSUFFICIENT_SCOPE";
     /** Route declared no required API key scope, so API keys are rejected (fail closed, #93) */
     readonly SCOPE_NOT_DECLARED: "SCOPE_NOT_DECLARED";
+    /** Production upload with no media storage provider configured (BLOB_READ_WRITE_TOKEN) */
+    readonly STORAGE_NOT_CONFIGURED: "STORAGE_NOT_CONFIGURED";
 };
 export type ApiErrorCode = typeof API_ERROR_CODES[keyof typeof API_ERROR_CODES];
 /**

package/dist/lib/api/api-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-error.d.ts","sourceRoot":"","sources":["../../../src/lib/api/api-error.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,eAAe;IAC1B,2DAA2D;;IAE3D,0FAA0F;;IAE1F,4FAA4F;;CAEpF,CAAA;AAEV,MAAM,MAAM,YAAY,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAA;AAE/E;;;;;GAKG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,OAAO,CAAA;gBAEL,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE;IAa5F;;OAEG;IACH,kBAAkB,IAAI,OAAO;IAI7B;;;;;OAKG;WACU,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;CAqC1F"}
+{"version":3,"file":"api-error.d.ts","sourceRoot":"","sources":["../../../src/lib/api/api-error.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,eAAe;IAC1B,2DAA2D;;IAE3D,0FAA0F;;IAE1F,4FAA4F;;IAE5F,0FAA0F;;CAElF,CAAA;AAEV,MAAM,MAAM,YAAY,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAA;AAE/E;;;;;GAKG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,OAAO,CAAA;gBAEL,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE;IAa5F;;OAEG;IACH,kBAAkB,IAAI,OAAO;IAI7B;;;;;OAKG;WACU,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;CAqC1F"}

package/dist/lib/api/api-error.js

@@ -4,7 +4,9 @@ const API_ERROR_CODES = {
   /** API key lacks the scope the route declared (authenticateRequest / hasRequiredScope) */
   INSUFFICIENT_SCOPE: "INSUFFICIENT_SCOPE",
   /** Route declared no required API key scope, so API keys are rejected (fail closed, #93) */
-  SCOPE_NOT_DECLARED: "SCOPE_NOT_DECLARED"
+  SCOPE_NOT_DECLARED: "SCOPE_NOT_DECLARED",
+  /** Production upload with no media storage provider configured (BLOB_READ_WRITE_TOKEN) */
+  STORAGE_NOT_CONFIGURED: "STORAGE_NOT_CONFIGURED"
 };
 class ApiError extends Error {
   code;

package/dist/lib/api/auth/dual-auth.d.ts

@@ -47,6 +47,7 @@ export interface DualAuthResult {
     keyId?: string;
     /** The session's id (type 'session' only): the active team cookie counts only for it. */
     sessionId?: string;
+    /** The 429 to return when a valid API key is over its per-key limit (`success` is false, `error` says 429). */
     rateLimitResponse?: Response;
     /** Set when a dev-only x-act-as-user override replaced the real caller. */
     actingAs?: {
@@ -126,7 +127,7 @@ export declare function createAuthError(message?: string, status?: number): Next
  * Turn a failed `authenticateRequest` result into the right HTTP response:
  * 401 `AUTHENTICATION_FAILED` when nothing usable was presented, 403
  * `INSUFFICIENT_SCOPE` / `SCOPE_NOT_DECLARED` when a valid API key was
- * rejected by scope enforcement. Use it in the `!authResult.success` branch
+ * rejected by scope enforcement, the 429 when the key is over its limit. Use it in the `!authResult.success` branch
  * instead of a hand-written 401, so scope rejections are not mislabeled.
  */
 export declare function createAuthFailureResponse(authResult: DualAuthResult): NextResponse;

package/dist/lib/api/auth/dual-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dual-auth.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/auth/dual-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAMvD,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EAKrB,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAK/F;;;GAGG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAA;AAExD;;GAEG;AACH,eAAO,MAAM,mBAAmB,mBAAmB,CAAA;AACnD,eAAO,MAAM,kBAAkB,8BAA8B,CAAA;AAE7D;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,kBAAkB,CAAA;AAOjD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAA;IACpC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,mHAAmH;IACnH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iBAAiB,CAAC,EAAE,QAAQ,CAAA;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3D,0EAA0E;IAC1E,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,cAAc,CAAC,CAsCzB;AAwKD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAUtG;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,cAAc,GACzB,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,CAsChC;AAMD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,cAAc,EAC1B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AA2BD;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,MAAkC,EAAE,MAAM,GAAE,MAAY;;;;GAShG;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,cAAc,GAAG,YAAY,CAUlF"}
+{"version":3,"file":"dual-auth.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/auth/dual-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAOvD,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EAKrB,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAK/F;;;GAGG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAA;AAExD;;GAEG;AACH,eAAO,MAAM,mBAAmB,mBAAmB,CAAA;AACnD,eAAO,MAAM,kBAAkB,8BAA8B,CAAA;AAE7D;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,kBAAkB,CAAA;AAOjD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAA;IACpC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,mHAAmH;IACnH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+GAA+G;IAC/G,iBAAiB,CAAC,EAAE,QAAQ,CAAA;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3D,0EAA0E;IAC1E,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,cAAc,CAAC,CA2DzB;AAmKD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAUtG;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,cAAc,GACzB,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,CAsChC;AAMD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,cAAc,EAC1B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AA2BD;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,MAAkC,EAAE,MAAM,GAAE,MAAY;;;;GAShG;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,cAAc,GAAG,YAAY,CAWlF"}

package/dist/lib/api/auth/dual-auth.js

@@ -3,6 +3,7 @@ import { getUserDefaultTeamId } from "../../teams/dashboard-team.js";
 import { NextResponse } from "next/server";
 import { auth } from "../../auth.js";
 import { validateApiKey } from "../auth.js";
+import { apiKeyRateLimitResponse } from "../rate-limit.js";
 import { queryOne } from "../../db.js";
 import { TeamMemberService } from "../../services/team-member.service.js";
 import { TeamService } from "../../services/team.service.js";
@@ -31,6 +32,26 @@ async function authenticateRequest(request, options = {}) {
         error: failure
       };
     }
+    const rateLimitResponse = apiKeyRateLimitResponse(request, {
+      userId: apiKeyResult.user.id,
+      keyId: apiKeyResult.keyId,
+      scopes: apiKeyResult.scopes ?? []
+    });
+    if (rateLimitResponse) {
+      return {
+        success: false,
+        type: "api-key",
+        user: apiKeyResult.user,
+        scopes: apiKeyResult.scopes,
+        keyId: apiKeyResult.keyId,
+        rateLimitResponse,
+        error: {
+          code: "RATE_LIMIT_EXCEEDED",
+          status: 429,
+          message: "Rate limit exceeded"
+        }
+      };
+    }
     return applyActAsOverride(request, apiKeyResult);
   }
   const sessionResult = await trySessionAuth(request);
@@ -120,15 +141,11 @@ async function tryApiKeyAuth(request) {
 async function trySessionAuth(request) {
   var _a;
   try {
-    console.log("[dual-auth] Attempting session authentication...");
     const session = await auth.api.getSession({ headers: request.headers });
-    console.log("[dual-auth] Session result:", session ? "found" : "not found");
     if (!(session == null ? void 0 : session.user)) {
-      console.log("[dual-auth] No session.user found");
       return { success: false, type: "none", user: null };
     }
     const defaultTeamId = await getUserDefaultTeamId(session.user.id);
-    console.log("[dual-auth] Session auth successful for user:", session.user.id);
     return {
       success: true,
       type: "session",
@@ -223,6 +240,7 @@ function createAuthError(message = "Authentication required", status = 401) {
   );
 }
 function createAuthFailureResponse(authResult) {
+  if (authResult.rateLimitResponse) return authResult.rateLimitResponse;
   const failure = authResult.error ?? authenticationFailed();
   return NextResponse.json(
     {

package/dist/lib/api/auth/scope-policy.d.ts

@@ -22,11 +22,14 @@
  * visible 403 on an integration instead of a silently over-privileged
  * credential. Before, `scopes` were populated and nobody was obliged to look.
  */
-export type DualAuthFailureCode = 'AUTHENTICATION_FAILED' | 'INSUFFICIENT_SCOPE' | 'SCOPE_NOT_DECLARED';
+export type DualAuthFailureCode = 'AUTHENTICATION_FAILED' | 'INSUFFICIENT_SCOPE' | 'SCOPE_NOT_DECLARED' | 'RATE_LIMIT_EXCEEDED';
 export interface DualAuthFailure {
     code: DualAuthFailureCode;
-    /** 401 when no usable credential was presented, 403 when a valid key was rejected on scope. */
-    status: 401 | 403;
+    /**
+     * 401 when no usable credential was presented, 403 when a valid key was rejected on scope, 429 when a valid
+     * key is over its per-key limit.
+     */
+    status: 401 | 403 | 429;
     message: string;
 }
 export interface AuthenticateOptions {

package/dist/lib/api/auth/scope-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-policy.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/auth/scope-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,MAAM,mBAAmB,GAC3B,uBAAuB,GACvB,oBAAoB,GACpB,oBAAoB,CAAA;AAExB,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAA;IACzB,+FAA+F;IAC/F,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,eAAe,CAEtD;AAED,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,mBAAmB,CAAC,eAAe,CAAC,GAAG,MAAM,EAAE,CAKrG;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACrC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAC/B,OAAO,CAIT;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/B;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAU/D;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACrC,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE,MAAM,GACZ,eAAe,GAAG,IAAI,CAuBxB"}
+{"version":3,"file":"scope-policy.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/auth/scope-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,MAAM,mBAAmB,GAC3B,uBAAuB,GACvB,oBAAoB,GACpB,oBAAoB,GACpB,qBAAqB,CAAA;AAEzB,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAA;IACzB;;;OAGG;IACH,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,eAAe,CAEtD;AAED,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,mBAAmB,CAAC,eAAe,CAAC,GAAG,MAAM,EAAE,CAKrG;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACrC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAC/B,OAAO,CAIT;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/B;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAU/D;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACrC,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE,MAAM,GACZ,eAAe,GAAG,IAAI,CAuBxB"}

package/dist/lib/api/auth.d.ts

@@ -21,6 +21,8 @@ export interface ApiKeyValidationResult {
     auth?: ApiKeyAuth;
     error?: string;
 }
+/** The API key validateApiKey accepted for this request, or null when none was validated. */
+export declare function getValidatedApiKey(request: Request): ApiKeyAuth | null;
 /**
  * Valida una API Key desde el header Authorization o x-api-key
  */

package/dist/lib/api/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/lib/api/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAoHrF;AA8CD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5E;AAID;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAM/E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAMhF;AAiBD;;GAEG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU;QAG1C,MAAM;WACH,MAAM;eACF,MAAM,GAAG,IAAI;cACd,MAAM,GAAG,IAAI;UACjB,MAAM;GAWjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBvE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC,CAyED"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/lib/api/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAQD,6FAA6F;AAC7F,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAEtE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA0GrF;AA8CD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5E;AAID;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAM/E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAMhF;AAiBD;;GAEG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU;QAG1C,MAAM;WACH,MAAM;eACF,MAAM,GAAG,IAAI;cACd,MAAM,GAAG,IAAI;UACjB,MAAM;GAWjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBvE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC,CAyED"}